Allow installation

ComputerIntune-readyPol_AllowInstallationMicrosoftEdgeBeta

Supported on Microsoft Edge Update 1.2.145.5 and later

155.0.4283.62

What it does

Specifies whether a Microsoft Edge channel can be installed on domain-joined devices. If you enable (1) this policy for a channel, Microsoft Edge will not be blocked from installation. If you disable (0) this policy for a channel (or set it to 'Installs disabled'), Microsoft Edge will be blocked from installation. If you don't configure this policy for a channel, the 'Allow installation default' policy configuration determines whether users can install that channel of Microsoft Edge. If you set this policy to Always allow Machine-Wide Installs but not Per-User Installs (4), Microsoft Edge Beta will only be deployed machine-wide. If you set this policy to Force Installs (Machine-Wide) (5), Microsoft Edge Beta may only be deployed machine-wide if Microsoft Edge Update is pre-installed. Requires Microsoft Edge Update 1.3.155.43 or higher. If you set this policy to Force Installs (Per-User) (6), Microsoft Edge Beta may only be deployed on a Per-User basis to all machines if Microsoft Edge Update is pre-installed Per-User. Requires Microsoft Edge Update 1.3.155.43 or higher. This policy is available only on Windows instances that are joined to a Microsoft® Active Directory® domain.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Policies\Microsoft\EdgeUpdate

Options

Option	Type	Registry value	Allowed values
Install PolicyRequiredDefault: Always allow Installs (recommended)	Drop-down list	`Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}`	Always allow Installs (recommended)`1` Installs disabled`0` Force Installs (Machine-Wide)`5` Always allow Machine-Wide Installs, but not Per-User Installs`4` Force Installs (Per-User)`6`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate]
"Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow installation
# Name: Pol_AllowInstallationMicrosoftEdgeBeta
# Scope: Machine
# State: Enabled
# Source: msedgeupdate.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate' -Name 'Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_msedgeupdate/Pol_AllowInstallationMicrosoftEdgeBeta

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_msedgeupdate/Pol_AllowInstallationMicrosoftEdgeBeta</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="Part_InstallPolicy" value="0"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Allow installation
# Name: Pol_AllowInstallationMicrosoftEdgeBeta
# Scope: Machine
# State: Enabled
# Source: msedgeupdate.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate' -Name 'Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate\Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow installation
# Name: Pol_AllowInstallationMicrosoftEdgeBeta
# Scope: Machine
# State: Enabled
# Source: msedgeupdate.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate' -Name 'Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}' -PropertyType 'DWord' -Value 1

History 37 retained releases

150.0.4078.8016 Jul 2026
- Already present in the first release ChangeIntel keeps.

36 later releases left it unchanged.

Template

Internal name: Pol_AllowInstallationMicrosoftEdgeBeta
Namespace: Microsoft.Policies.Update
Template file: msedgeupdate.admx
Release: Microsoft Edge 155.0.4283.62 · file set 0a733b0040dbbf02…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.Pol_AllowInstallation)" explainText="$(string.Explain_InstallMicrosoftEdgeBeta)" key="Software\Policies\Microsoft\EdgeUpdate" name="Pol_AllowInstallationMicrosoftEdgeBeta" presentation="$(presentation.Pol_AllowInstallation)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Update:Cat_MicrosoftEdgeBeta" />
      <supportedOn ref="Microsoft.Policies.Update:Sup_GoogleUpdate1_2_145_5" />
      <elements>
        <enum id="Part_InstallPolicy" required="true" valueName="Install{2CD8A007-E189-409D-A2C8-9AF4EF3C72AA}">
          <item displayName="$(string.Name_InstallsEnabled)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.Name_InstallsDisabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          
          <item displayName="$(string.Name_ForceInstallsMachine)">
            <value>
              <decimal value="5" />
            </value>
          </item>
          <item displayName="$(string.Name_InstallsEnabledMachineOnly)">
            <value>
              <decimal value="4" />
            </value>
          </item>
          <item displayName="$(string.Name_ForceInstallsUser)">
            <value>
              <decimal value="6" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="Pol_AllowInstallation" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="0" refId="Part_InstallPolicy">Install Policy</dropdownList>
      </presentation>

Supported platforms and category

Microsoft.Policies.Update:category:Cat_Applications
<category displayName="$(string.Cat_Applications)" explainText="$(string.Explain_Applications)" name="Cat_Applications" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Update:Cat_EdgeUpdate" />
    </category>
Microsoft.Policies.Update:category:Cat_EdgeUpdate
<category displayName="$(string.Cat_GoogleUpdate)" explainText="$(string.Explain_GoogleUpdate)" name="Cat_EdgeUpdate" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
    </category>
Microsoft.Policies.Update:category:Cat_MicrosoftEdgeBeta
<category displayName="$(string.Cat_MicrosoftEdgeBeta)" name="Cat_MicrosoftEdgeBeta" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Update:Cat_Applications" />
    </category>
Microsoft.Policies.Update:definition:Sup_GoogleUpdate1_2_145_5
<definition displayName="$(string.Sup_GoogleUpdate1_2_145_5)" name="Sup_GoogleUpdate1_2_145_5" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Update:category:Cat_Applications
<category displayName="$(string.Cat_Applications)" explainText="$(string.Explain_Applications)" name="Cat_Applications" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Update:Cat_EdgeUpdate" />
    </category>
<strings><string id="Microsoft.Policies.Update:Cat_Applications">Applications</string><string id="Microsoft.Policies.Update:Explain_Applications">An updated ADMX/ADML template will be required to support Edge applications released in the future.</string></strings>
Microsoft.Policies.Update:category:Cat_EdgeUpdate
<category displayName="$(string.Cat_GoogleUpdate)" explainText="$(string.Explain_GoogleUpdate)" name="Cat_EdgeUpdate" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
    </category>
<strings><string id="Microsoft.Policies.Update:Cat_GoogleUpdate">Microsoft Edge Update</string><string id="Microsoft.Policies.Update:Explain_GoogleUpdate">Policies to control the installation and updating of Microsoft Edge using Microsoft Edge Update.</string></strings>
Microsoft.Policies.Update:category:Cat_MicrosoftEdgeBeta
<category displayName="$(string.Cat_MicrosoftEdgeBeta)" name="Cat_MicrosoftEdgeBeta" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Update:Cat_Applications" />
    </category>
<strings><string id="Microsoft.Policies.Update:Cat_MicrosoftEdgeBeta">Microsoft Edge Beta</string></strings>
Microsoft.Policies.Update:definition:Sup_GoogleUpdate1_2_145_5
<definition displayName="$(string.Sup_GoogleUpdate1_2_145_5)" name="Sup_GoogleUpdate1_2_145_5" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Update:Sup_GoogleUpdate1_2_145_5">Microsoft Edge Update 1.2.145.5 and later</string></strings>